ssh login with publickey still ask password - ssh

I have add public key id_rsa.pub to remote /home/user authorizationkeys. About permission this file was 600 and parent dir .ssh was 700. I have also modified sshd_config.
when I perform ssh -vv user#remote errors show below
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /home/hjjj/.ssh/identity ((nil))
debug2: key: /home/hjjj/.ssh/id_rsa (0x55b3d8c54bc0)
debug2: key: /home/hjjj/.ssh/id_dsa ((nil))
debug2: key: /home/hjjj/.ssh/id_ecdsa ((nil))
debug3: Wrote 84 bytes for a total of 1309
debug1: Authentications that can continue: password,publickey
debug3: start over, passed a different list password,publickey
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /home/hjjj/.ssh/identity
debug3: no such identity: /home/hjjj/.ssh/identity
debug1: Offering public key: /home/hjjj/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug3: Wrote 388 bytes for a total of 1697
debug1: Authentications that can continue: password,publickey
debug1: Trying private key: /home/hjjj/.ssh/id_dsa
debug3: no such identity: /home/hjjj/.ssh/id_dsa
debug1: Trying private key: /home/hjjj/.ssh/id_ecdsa
debug3: no such identity: /home/hjjj/.ssh/id_ecdsa
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password
123_hjjj#remote's password:
debug3: packet_send2: adding 48 (len 65 padlen 15 extra_pad 64)
debug2: we sent a password packet, wait for reply
debug3: Wrote 148 bytes for a total of 1845.
--- edit ---
Thanks first. I checked below: I haved login client with non-root userA and I want to login remote server with non-root userB which I can access successfully with password authentication. I also add userA's id_rsa.pub to userB's authorized_keys file. The sshd_config was---
# Authentication:
#LoginGraceTime 2m
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10
RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
#AuthorizedKeysCommand none
#AuthorizedKeysCommandRunAs nobody
And I can't find auth.log under /var/log but /var/log/secure. After I execute ssh userB#remote -p 9998 on client, the log output was:
sshd[22208]: Connection closed by 192.168.5.38

When you have problems with ssh, it's always a good idea to start ssh with -v.
From your log you can see that you offered your key (Offering public key: /home/hjjj/.ssh/id_rsa),
but it wasn't accepted (missing Server accepts key)
The next steps on the client side should be:
Verify you are using the correct user
Verify that you are connecting to the expected server
Then you should switch to the server:
Check your /etc/ssh/sshd_config for PubkeyAuthentication yes
Check the entries in /var/log/auth.log

Related

SFTP on Windows gives error : read_passphrase: can't open /dev/tty: No such file or directory

I am trying to use the windows SFTP command to connect to a server using a .pem openssh key file.
This command works on my own PC and on a LINUX AWS server however when I copy the y.pem file to an AWS windows server and try to connect from there, it gives the error below and asks for a non existent password. There is no passphrase or password to enter, only a .pem file is used to authenticate.
I am also able to connect from this windows server using filezilla so I am at a loss as to why the sftp fails?
sftp -vvv -i y.pem rdg-test-sftp#xxxxx.com
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,password
debug3: start over, passed a different list publickey,password
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: y.pem
debug3: sign_and_send_pubkey: RSA SHA256:1hkUUEqCCk5Uy9jTbQ9hclYk7swm+dODpWFE3FXecIc
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,password
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password
debug3: failed to open file:C:/dev/tty error:3
debug1: read_passphrase: can't open /dev/tty: No such file or directory
rdg-test-fstp#xxxxx.com's password:
Connection closed

Deny all as default authentication-options in sshd

I want sshd (OpenSSH_8.0p1), to have no authentication methods (AuthenticationMethods) as standard, and therefor just drop the connection.
My plan is to create match-blocks like:
Match User user1
PasswordAuthentication yes
PubkeyAuthentication yes
AuthenticationMethods publickey,password publickey,keyboard-interactive
to allow people.
In my sshd_config, I have
PasswordAuthentication no
HostbasedAuthentication no
ChallengeResponseAuthentication no
KerberosAuthentication no
GSSAPIAuthentication no
PubkeyAuthentication no
AuthenticationMethods none
but even so, the ssh client will prompt for a password if I try to login to the server using the wrong user.
I can see in the logs on the server
Sep 9 11:35:53 server1 sshd[113293]: debug1: userauth-request for user dummy service ssh-connection method none [preauth]
Sep 9 11:35:53 server1 sshd[113293]: debug1: attempt 0 failures 0 [preauth]
Sep 9 11:35:53 server1 sshd[113293]: debug1: authentication methods list 0: none
Sep 9 11:35:53 server1 sshd[113293]: debug1: authentication methods list 0: none [preauth]
Sep 9 11:35:53 server1 sshd[113293]: debug1: userauth-request for user dummy service ssh-connection method keyboard-interactive [preauth]
Sep 9 11:35:53 server1 sshd[113293]: debug1: attempt 1 failures 0 [preauth]
and on the client
debug1: Authentications that can continue:
debug3: start over, passed a different list gssapi-with-mic,publickey,keyboard-interactive,password
debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup gssapi-with-mic
debug3: remaining preferred: publickey,keyboard-interactive,password
debug3: authmethod_is_enabled gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug1: Unspecified GSS failure. Minor code may provide more information
...
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickeydebug1: Next authentication method: publickey
debug1: Trying private key: /root/.ssh/id_rsa
...
debug3: authmethod_lookup keyboard-interactive
debug3: remaining preferred: password
debug3: authmethod_is_enabled keyboard-interactive
debug1: Next authentication method: keyboard-interactive
debug2: userauth_kbdint
debug3: send packet: type 50
debug2: we sent a keyboard-interactive packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue:
debug3: userauth_kbdint: disable: no info_req_seen
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred:
debug3: authmethod_is_enabled password
debug1: Next authentication method: password
Why is the server refusing password prompt, then changes its mind?
This is also happening with UsePAM no

Gitlab on premise > permission denied (ssh key login)

I'm trying since hours to get the ssh login working.
The Server is on Debian 10 and the clients are on Linux Mint and Windows 10.
This is the error trying to login with:
ssh -Tvvv git#dev.example.io
debug1: Will attempt key: /home/herbert/.ssh/pubkey RSASHA256:LygJtb4xx3RHfaMr1wM3sgSjTnj59nNUFgnQZO/0xoo explicit agent
debug2: pubkey_prepare: done
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred publickey
debug3: authmethod_lookup publickey
debug3: remaining preferred:
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering public key: /home/herbert/.ssh/pubkey RSA SHA256:LygJtb4xx3RHfaMr1qM3sgSjTnj59nNUFgnQZO/0xoo explicit agent
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
git#dev.example.io: Permission denied (publickey).
This is the ssh config file:
Host dev.example.io
HostName dev.example.io
PreferredAuthentications publickey
IdentityFile ~/.ssh/pubkey
PubkeyAcceptedKeyTypes +ssh-rsa
I have also tried "Fast lookup of authorized SSH keys in the database" to get things working, but they don't.
Maybe someone has an idea how to debug what is going wrong, for the moment I have no idea > it's a fresh gitlab installation and I have never had this problem before with an installation.
Thank you.
PS: Of cause > the rsa keys are correct on gitlab and they are also correct saved in the autohorized_keys file.
Whenever the SSH looks OK on client side, and yet is refused by the server side, assuming you have access to the server, you can consider debugging there.
On that Debian server:
stop the SSH daemon
relaunch it manually (using its full path)
make one connection from the client
look on the server stdout the output from the daemon
That is, on Debian server side:
sudo systemctl stop ssh.service
/usr/sbin/sshd -dd

Passwordless access to raspberry pi via ssh

I can't setup passwordless access to Raspberry Pi. I am using similar instructions like this one. But it still asks for password when I
ssh to my raspberry. I made this with other servers and everything worked ok, but not with my raspberry (both of them).
Thanks to Jakuje, become a little bit clearer:
successful debug log:
debug1: Offering RSA public key: /home/tmp/.ssh/id_rsa
debug3: send_pubkey_test
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 60
debug1: Server accepts key: pkalg ssh-rsa blen 535
debug2: input_userauth_pk_ok: fp SHA256:XPQA6tgcRCam/L18YP4ccPwsOsGtO65ippi7kua4mTM
debug3: sign_and_send_pubkey: RSA SHA256:XPQA6tgcRCam/L18YP4ccPwsOsGtO65ippi7kua4mTM
debug3: send packet: type 50
debug3: receive packet: type 52
debug1: Authentication succeeded (publickey).
fail log:
debug1: Offering RSA public key: /home/tmp/.ssh/id_rsa
debug3: send_pubkey_test
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /home/tmp/.ssh/id_dsa
debug3: no such identity: /home/tmp/.ssh/id_dsa: No such file or directory
debug1: Trying private key: /home/tmp/.ssh/id_ecdsa
debug3: no such identity: /home/tmp/.ssh/id_ecdsa: No such file or directory
debug1: Trying private key: /home/tmp/.ssh/id_ed25519
debug3: no such identity: /home/tmp/.ssh/id_ed25519: No such file or directory
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password
Why it ignores id_rsa key and asks for id_dsa ???
debug1: Offering RSA public key: /home/tmp/.ssh/id_rsa
debug3: send_pubkey_test
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,password
says that the key was tried but not accepted by server. There will be a problem in server configuration/permissions. Running the server in debug mode identifies where the problem is. The owners and permissions on home directory, .ssh directory should be the following:
chmod g-w /home/your_user
chmod 700 /home/your_user/.ssh
chmod 600 /home/your_user/.ssh/authorized_keys

how to ssh to a server without password when there is no .ssh on it

I wanted to setup passwordless login from my local machine to this Linux server. When I tried to upload my public key I found that there is no .ssh on the server. So I created one with ssh-keygen on the server. However in the newly generated .ssh directory, there is no authorized_keys or known_hosts. So I made a new authorized_keys and pasted my public key from local machine. However it does not work, still need password for ssh. Can anyone tell me if I am doing it right?
Here is the output of ssh -vvv:
debug1: Authentications that can continue: publickey,gssapi-with-mic,password,keyboard-interactive
debug3: start over, passed a different list publickey,gssapi-with-mic,password,keyboard-interactive
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup gssapi-with-mic
debug3: remaining preferred: publickey,keyboard-interactive,password
debug3: authmethod_is_enabled gssapi-with-mic
debug1: Next authentication method: gssapi-with-mic
debug3: Trying to reverse map address .
debug1: Unspecified GSS failure. Minor code may provide more information
Credentials cache file '/tmp/krb5cc_198782' not found
debug1: Unspecified GSS failure. Minor code may provide more information
Credentials cache file '/tmp/krb5cc_198782' not found
debug1: Unspecified GSS failure. Minor code may provide more information
debug1: Unspecified GSS failure. Minor code may provide more information
Credentials cache file '/tmp/krb5cc_198782' not found
debug2: we did not send a packet, disable method
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering public key: /rsrch2/rists/djiao/.ssh/id_rsa
debug3: send_pubkey_test
debug2: we sent a publickey packet, wait for reply
debug3: Wrote 368 bytes for a total of 1477
debug1: Authentications that can continue: publickey,gssapi-with-mic,password,keyboard-interactive
debug1: Trying private key: /rsrch2/rists/djiao/.ssh/id_dsa
debug3: no such identity: /rsrch2/rists/djiao/.ssh/id_dsa
debug2: we did not send a packet, disable method
debug3: authmethod_lookup keyboard-interactive
debug3: remaining preferred: password
debug3: authmethod_is_enabled keyboard-interactive
debug1: Next authentication method: keyboard-interactive
debug2: userauth_kbdint
debug2: we sent a keyboard-interactive packet, wait for reply
debug3: Wrote 96 bytes for a total of 1573
debug2: input_userauth_info_req
debug2: input_userauth_info_req: num_prompts 1
Simply create it and copy your key over to it. If you have a key-copy tool then just create the file via
$ touch ~/.ssh/authorized_keys
before using the tool.
It might help to connect using -vvv for verbosity.
On the client and on the server, check that ~/.ssh has permissions 700.
On the server, check that /etc/ssh/sshd_config has:
AuthorizedKeysFile .ssh/authorized_keys
PubkeyAuthentication yes
RSAAuthentication yes